@agenticprimitives/ontology 1.0.0-alpha.4 → 1.0.0-alpha.41

package/tbox/naming.ttl

@@ -0,0 +1,114 @@
+# T-box — typed agent naming (spec 346 §3, §11; ADR-0061).
+#
+# The name class itself (apnam:NameFacet ⊑ ap:Facet — a resolvable name that points AT an Agent and is
+# never the sole authority, ADR-0006) stays in tbox/identity.ttl with the other facets. This module adds
+# what typed naming needs on top of it:
+#
+#   apnam:tld                       the canonical suffix — NAMES the derived type (.me .org .team .svc
+#                                   .workspace .treasury .registry); a CLAIM checked against the SA's
+#                                   on-chain ap:agentType record, never authority and never structure
+#   apnam:ContextualNameIssuance    a name issued BY a context (org / team / workspace agent) in its own
+#                                   namespace, current only while its basis delegation is live
+#   apnam:ContextualAgentReference  a resolved `x@ctx` — a REFERENCE composing the canonical subject
+#                                   with an actor context, a role assignment and the live delegation;
+#                                   never an agent, never a second identity
+#
+# What a suffix is NOT (ADR-0061 §3): the inheritance structure, a root, a role, a technology. Resolution
+# maps suffix → derived type → root; `rpedersen.me@richcanvas.org` still resolves to a Person — the
+# `@richcanvas.org` is context, not classification.
+
+@prefix apnam:   <https://agenticprimitives.dev/ns/naming#> .
+@prefix ap:      <https://agenticprimitives.dev/ns/core#> .
+@prefix apdel:   <https://agenticprimitives.dev/ns/delegation#> .
+@prefix apactor: <https://agenticprimitives.dev/ns/actor#> .
+@prefix aporg:   <https://agenticprimitives.dev/ns/org#> .
+@prefix rdfs:    <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix owl:     <http://www.w3.org/2002/07/owl#> .
+@prefix xsd:     <http://www.w3.org/2001/XMLSchema#> .
+@prefix prov:    <http://www.w3.org/ns/prov#> .
+@prefix skos:    <http://www.w3.org/2004/02/skos/core#> .
+
+<https://agenticprimitives.dev/ns/naming> a owl:Ontology ;
+    rdfs:label "Agentic Primitives — typed agent naming (spec 346)" ;
+    owl:versionInfo "0.1.0" ;
+    rdfs:comment "Typed suffixes, contextual name issuance, contextual references. A name is a facet (ADR-0006/ADR-0010): decorative, resolvable, replaceable — never the identifier and never authority." .
+
+# ─── The typed suffix ────────────────────────────────────────────────────────
+
+apnam:tld a owl:DatatypeProperty ;
+    rdfs:domain apnam:NameFacet ;
+    rdfs:range xsd:string ;
+    rdfs:label "tld" ;
+    rdfs:comment "The canonical suffix; names the derived type — derivedTypeForTld. NEVER authority. Values are the prefLabels of apnam:tldScheme (cbox): me org team svc workspace treasury registry; 'ws' is an alias of 'workspace', never stored. Legacy roots (.agent, .impact) carry no tld and are exempt from apnam:TypedAgentNameShape." .
+
+apnam:namesDerivedType a owl:ObjectProperty ;
+    rdfs:domain skos:Concept ;
+    rdfs:range skos:Concept ;
+    rdfs:label "namesDerivedType" ;
+    rdfs:comment "apnam:tldScheme concept → ap:agentTypeScheme concept: the suffix→derived-type map the resolver applies and TypedAgentNameShape checks a name's target against. Fixed data, not a lookup any caller may widen." .
+
+# ─── Contextual issuance ─────────────────────────────────────────────────────
+
+apnam:ContextualNameIssuance a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "ContextualNameIssuance" ;
+    rdfs:comment "A name issued by a context (org/team/workspace agent) in its namespace: kind scoped | reference; basis = a membership+delegation, an operatedBy delegation, or a charter mandate. Vault record; anchored on chain iff listing public." .
+
+apnam:issuedBy a owl:ObjectProperty ;
+    rdfs:domain apnam:ContextualNameIssuance ;
+    rdfs:range ap:Agent ;
+    rdfs:label "issuedBy" ;
+    rdfs:comment "The context that issued the name — an Organization (incl. Team) or a WorkspaceAgent (apnam:ContextualNameIssuanceShape)." .
+
+apnam:issuedFor a owl:ObjectProperty ;
+    rdfs:domain apnam:ContextualNameIssuance ;
+    rdfs:range ap:Agent ;
+    rdfs:label "issuedFor" ;
+    rdfs:comment "The canonical subject the contextual name refers to. Its own canonical name is untouched by the issuance." .
+
+apnam:issuanceBasis a owl:ObjectProperty ;
+    rdfs:domain apnam:ContextualNameIssuance ;
+    rdfs:range apdel:Delegation ;
+    rdfs:label "issuanceBasis" ;
+    rdfs:comment "The delegation whose liveness makes the name CURRENT. A reference, never a grant." .
+
+apnam:issuanceKind a owl:DatatypeProperty ;
+    rdfs:domain apnam:ContextualNameIssuance ;
+    rdfs:range xsd:string ;
+    rdfs:label "issuanceKind" ;
+    rdfs:comment "scoped | reference (spec 346 §3.2 — same syntax, one meaning). A 'reference' issuance names ANOTHER agent in the issuer's namespace, so issuedFor must differ from issuedBy." .
+
+apnam:issuedName a owl:DatatypeProperty ;
+    rdfs:domain apnam:ContextualNameIssuance ;
+    rdfs:range xsd:string ;
+    rdfs:label "issuedName" ;
+    rdfs:comment "The full contextual form as issued (e.g. rpedersen.me@richcanvas.org)." .
+
+# ─── The resolved contextual reference ───────────────────────────────────────
+
+apnam:ContextualAgentReference a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "ContextualAgentReference" ;
+    rdfs:comment "A resolved x@ctx: canonical subject + apactor:ActorContext + aporg:RoleAssignment + the live delegation. A reference — never an agent, never an identity." .
+
+apnam:referenceSubject a owl:ObjectProperty ;
+    rdfs:domain apnam:ContextualAgentReference ;
+    rdfs:range ap:Agent ;
+    rdfs:label "referenceSubject" ;
+    rdfs:comment "The canonical Smart Agent the reference resolves to (ADR-0010)." .
+
+apnam:referenceContext a owl:ObjectProperty ;
+    rdfs:domain apnam:ContextualAgentReference ;
+    rdfs:range apactor:ActorContext ;
+    rdfs:label "referenceContext" .
+
+apnam:referenceRoleAssignment a owl:ObjectProperty ;
+    rdfs:domain apnam:ContextualAgentReference ;
+    rdfs:range aporg:RoleAssignment ;
+    rdfs:label "referenceRoleAssignment" .
+
+apnam:referenceBasis a owl:ObjectProperty ;
+    rdfs:domain apnam:ContextualAgentReference ;
+    rdfs:range apdel:Delegation ;
+    rdfs:label "referenceBasis" ;
+    rdfs:comment "The live delegation the reference resolves through. Revoke it and the reference deactivates; the canonical name is untouched (ADR-0061 §6)." .

package/tbox/org.ttl

@@ -0,0 +1,410 @@
+# T-box — organization membership, roles, enrollment (spec 324 §4–§8); team affiliation, workspace,
+# responsibility (spec 344 §4.2). OrganizationMembership is a Situation — not a delegation, not a
+# directory listing. A Workspace is an ENTITY (a governed coordination plane) — never an agent, never a
+# tenant; its agentive face is the ap:WorkspaceAgent it is coordinatedBy (ADR-0061 §4).
+
+@prefix aporg: <https://agenticprimitives.dev/ns/org#> .
+@prefix apsit: <https://agenticprimitives.dev/ns/situation#> .
+@prefix ap:    <https://agenticprimitives.dev/ns/core#> .
+@prefix apdel: <https://agenticprimitives.dev/ns/delegation#> .
+@prefix apent: <https://agenticprimitives.dev/ns/entitlement#> .
+@prefix apint: <https://agenticprimitives.dev/ns/intent#> .
+@prefix apmsg: <https://agenticprimitives.dev/ns/messaging#> .
+@prefix aps:   <https://agenticprimitives.dev/ns/skill#> .
+@prefix skos:  <http://www.w3.org/2004/02/skos/core#> .
+@prefix rdf:   <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix rdfs:  <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix owl:   <http://www.w3.org/2002/07/owl#> .
+@prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .
+@prefix prov:  <http://www.w3.org/ns/prov#> .
+
+aporg: a owl:Ontology ;
+    rdfs:label "Agentic Primitives — organization ontology" ;
+    owl:versionInfo "0.4.0" ;
+    rdfs:comment "Membership, roles, enrollment instruments (spec 324); team affiliation, workspaces (the governed coordination plane) and responsibilities (spec 344 §4.2). DirectoryListing remains in tbox/messaging.ttl for wire compat." .
+
+# ─── Membership ───────────────────────────────────────────────────────
+
+aporg:OrganizationMembership a owl:Class ;
+    rdfs:subClassOf apsit:Situation ;
+    rdfs:label "OrganizationMembership" ;
+    rdfs:comment "Private-by-default Situation: exactly one memberAgent + one organizationAgent under an EnrollmentDecision. Member is NOT a class." .
+
+aporg:memberAgent a owl:ObjectProperty ;
+    rdfs:domain aporg:OrganizationMembership ; rdfs:range ap:Agent ;
+    rdfs:label "memberAgent" .
+
+aporg:organizationAgent a owl:ObjectProperty ;
+    rdfs:domain aporg:OrganizationMembership ; rdfs:range ap:OrganizationAgent ;
+    rdfs:label "organizationAgent" .
+
+aporg:hasRoleAssignment a owl:ObjectProperty ;
+    rdfs:domain aporg:OrganizationMembership ; rdfs:range aporg:RoleAssignment ;
+    rdfs:label "hasRoleAssignment" .
+
+# Convenience projection only — active membership is resolved externally (SHACL/resolver).
+aporg:memberOf a owl:ObjectProperty ;
+    rdfs:domain ap:Agent ; rdfs:range ap:OrganizationAgent ;
+    rdfs:label "memberOf" ;
+    rdfs:comment "DERIVED: true iff active, valid, disclosable OrganizationMembership exists. Never asserted globally." .
+
+# ─── Contacts — membership on the PERSON agent (spec 401) ─────────────────────────────────────────────
+# A contact is an agent a person has let in — a friend, a coach service, an outside runtime, an assistant —
+# admitted by the person with a scoped access grant and recorded in the person's own vault, as an
+# organization records a member. What it IS: the same shape as OrganizationMembership with a PERSON where the
+# organization stands (aporg:contactOf · aporg:contactAgent). What it is NOT: public (ADR-0025 — a contact
+# list is a private link), a class of agent (a contact is a role a relation carries), or authority (the grant
+# is; the role — friend, family, coach, assistant, runtime — authorizes nothing, like a household's kinship).
+
+aporg:Contact a owl:Class ;
+    rdfs:subClassOf apsit:Situation ;
+    rdfs:label "Contact" ;
+    rdfs:comment "Private-by-default Situation: exactly one contactAgent + one personAgent (the person who let them in), under the person's own access grant. Membership on a person; never public." .
+
+aporg:contactAgent a owl:ObjectProperty ;
+    rdfs:domain aporg:Contact ; rdfs:range ap:Agent ;
+    rdfs:label "contactAgent" ;
+    rdfs:comment "The agent let in — a person, a service (a coach, an outside runtime), an assistant. Never an organization: one belongs to an organization or not." .
+
+aporg:contactOf a owl:ObjectProperty ;
+    rdfs:domain aporg:Contact ; rdfs:range ap:PersonAgent ;
+    rdfs:label "contactOf" ;
+    rdfs:comment "The person whose contact this is — the principal of the record, the issuer of the grant." .
+
+aporg:contactRole a owl:DatatypeProperty ;
+    rdfs:domain aporg:Contact ; rdfs:range xsd:string ;
+    rdfs:label "contactRole" ;
+    rdfs:comment "Declarative: friend · family · coach · assistant · runtime · other. Authorizes nothing (spec 368's kinship facets are the precedent)." .
+
+# ─── Contact roles — the five words a person has for what a contact is TO THEM ───────────────────
+# Individuals, so a role is a fact the ontology names rather than a string a picker owns (agent-vocabulary.md §5).
+# A role is DECLARATIVE: it authorizes nothing; the contact's grant does. A coach is a contact with role coach —
+# there is no Coach class, as there is no Runtime class: both are ap:ServiceAgent with a role.
+aporg:ContactRole a owl:Class ;
+    rdfs:label "ContactRole" ;
+    rdfs:comment "What a contact is to the person who let them in. Closed set of individuals; declarative; never a basis." .
+aporg:contactRoleOf a owl:ObjectProperty ;
+    rdfs:domain aporg:Contact ; rdfs:range aporg:ContactRole ;
+    rdfs:label "contactRoleOf" ;
+    rdfs:comment "The role as an individual — the object form of aporg:contactRole (the string form is kept for the wire)." .
+aporg:role-friend a aporg:ContactRole ; rdfs:label "friend" ; rdfs:comment "A person you know; becomes mutual when they add you back." .
+aporg:role-family a aporg:ContactRole ; rdfs:label "family" ; rdfs:comment "A person of your household or kin (the household's kinship facet is the precedent, spec 368)." .
+aporg:role-coach a aporg:ContactRole ; rdfs:label "coach" ; rdfs:comment "A SERVICE you consult under a study grant (a canasta coach, a holdem coach). One-way." .
+aporg:role-assistant a aporg:ContactRole ; rdfs:label "assistant" ; rdfs:comment "A SERVICE that acts for you or answers you — an assistant app, an assistant service. One-way." .
+aporg:role-runtime a aporg:ContactRole ; rdfs:label "runtime" ; rdfs:comment "A SERVICE that is your own runtime — Claude Code, goose — paired at your Home (spec 400 W1b). One-way." .
+aporg:role-other a aporg:ContactRole ; rdfs:label "other" ; rdfs:comment "A contact with no role named." .
+
+# ─── Roles ────────────────────────────────────────────────────────────
+
+aporg:OrganizationRoleDefinition a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "OrganizationRoleDefinition" ;
+    rdfs:comment "Reusable org-scoped role template. Declarative — does not authorize execution." .
+
+aporg:OrganizationalPost a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "OrganizationalPost" ;
+    rdfs:comment "Enduring org position (e.g. Acme CFO post), distinct from OrganizationRoleDefinition template. W3C ORG Post pattern (spec 325)." .
+
+aporg:RoleAssignment a owl:Class ;
+    rdfs:subClassOf apsit:Situation ;
+    rdfs:label "RoleAssignment" ;
+    rdfs:comment "Connects OrganizationMembership to OrganizationRoleDefinition. Materialized by Delegations — not itself authority." .
+
+aporg:assignedMembership a owl:ObjectProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range aporg:OrganizationMembership ;
+    rdfs:label "assignedMembership" .
+
+aporg:assignedRole a owl:ObjectProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range aporg:OrganizationRoleDefinition ;
+    rdfs:label "assignedRole" .
+
+aporg:materializedByDelegation a owl:ObjectProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range apdel:Delegation ;
+    rdfs:label "materializedByDelegation" .
+
+# Spec 427 — what a role OFFERS, and what a membership's role assignment records about itself. None of these is
+# authority: a gate reads the delegation (materializedByDelegation), never a role's name, its access word or its pack.
+
+aporg:offersSkillPack a owl:ObjectProperty ;
+    rdfs:domain aporg:OrganizationRoleDefinition ; rdfs:range aps:AgentArchetype ;
+    rdfs:label "offersSkillPack" ;
+    rdfs:comment "A skill pack — an archetype in the skills registry — the role OFFERS the agent of whoever holds it (spec 427). Offers, never installs: only the agent's own custodian writes its playbook, and a pack confers no authority." .
+
+aporg:offeredSkillPack a owl:ObjectProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range aps:AgentArchetype ;
+    rdfs:label "offeredSkillPack" ;
+    rdfs:comment "The skill pack(s) the role offered WHEN IT WAS ASSIGNED, snapshotted on the assignment so the member's Home can offer the pack without resolving the definition. A later change to the definition does not rewrite an assignment." .
+
+aporg:roleDefinitionId a owl:DatatypeProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range xsd:string ;
+    rdfs:label "roleDefinitionId" ;
+    rdfs:comment "The defining organization's own id for the role definition assigned (`roledef:<org>:<slug>@<version>`), kept on the assignment so a roster names the definition without resolving it." .
+
+aporg:roleName a owl:DatatypeProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range xsd:string ;
+    rdfs:label "roleName" ;
+    rdfs:comment "The role's name as a person reads it (\"Field worker\"). A word; authorizes nothing." .
+
+aporg:roleDescription a owl:DatatypeProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range xsd:string ;
+    rdfs:label "roleDescription" ;
+    rdfs:comment "The sentence the organization offered the role with, snapshotted on the assignment." .
+
+aporg:roleScope a owl:DatatypeProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range xsd:string ;
+    rdfs:label "roleScope" ;
+    rdfs:comment "Where the role is held: `organization` or `team`. A team is an organization and holds its own members (spec 344), so a team-scoped role is on the team's membership record." .
+
+aporg:accessRole a owl:DatatypeProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range xsd:string ;
+    rdfs:label "accessRole" ;
+    rdfs:comment "The access role, in the issuing application's vocabulary, whose delegations materialize this role by default (spec 343). It EXPLAINS the access; the delegations are the access." .
+
+aporg:assignedBy a owl:ObjectProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range ap:Agent ;
+    rdfs:label "assignedBy" ;
+    rdfs:comment "The steward whose invitation, or whose later change, named the role." .
+
+aporg:assignedAt a owl:DatatypeProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range xsd:dateTime ;
+    rdfs:label "assignedAt" .
+
+aporg:roleSetAt a owl:DatatypeProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range xsd:dateTime ;
+    rdfs:label "roleSetAt" ;
+    rdfs:comment "Present only when a steward SET the role after admission. A role so set stands: re-running the member's join never replaces it with the invitation's." .
+
+aporg:proposesRoleDefinition a owl:ObjectProperty ;
+    rdfs:domain aporg:MembershipInvitation ; rdfs:range aporg:OrganizationRoleDefinition ;
+    rdfs:label "proposesRoleDefinition" ;
+    rdfs:comment "A role definition an invitation proposes the invitee be assigned on admission (spec 324 §5). A proposal: satisfying the invitation records the role, and grants nothing by itself." .
+
+aporg:supportedByEntitlement a owl:ObjectProperty ;
+    rdfs:domain aporg:RoleAssignment ; rdfs:range apent:AccessEntitlement ;
+    rdfs:label "supportedByEntitlement" .
+
+# ─── Enrollment instruments (not membership) ──────────────────────────
+
+aporg:EnrollmentPolicy a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "EnrollmentPolicy" ;
+    rdfs:comment "Organization joining policy. 'Admission' is ingress-only (ADR-0043) — use Enrollment for org joining." .
+
+aporg:EnrollmentRequirement a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "EnrollmentRequirement" ;
+    rdfs:comment "Eligibility predicate; satisfying it does not create membership." .
+
+aporg:MembershipInvitation a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "MembershipInvitation" ;
+    rdfs:comment "Directed enrollment proposal org→agent. Not a membership." .
+
+aporg:MembershipInviteLink a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "MembershipInviteLink" ;
+    rdfs:comment "Bearer enrollment instrument (tokenHash only in storage). Not a Delegation." .
+
+aporg:MembershipApplication a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "MembershipApplication" ;
+    rdfs:comment "Join request; usually expresses JoinOrganizationIntent via REQUEST act." .
+
+aporg:EnrollmentDecision a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "EnrollmentDecision" ;
+    rdfs:comment "Signed approve/reject. Approval creates OrganizationMembership — does not grant arbitrary authority." .
+
+aporg:MembershipTermination a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "MembershipTermination" .
+
+aporg:AdmissionExclusion a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "AdmissionExclusion" ;
+    rdfs:comment "Org-level exclusion record — not ingress admission." .
+
+aporg:expressesJoinIntent a owl:ObjectProperty ;
+    rdfs:domain aporg:MembershipApplication ; rdfs:range apint:JoinOrganizationIntent ;
+    rdfs:label "expressesJoinIntent" .
+
+# ═══ spec 344 §4.2 — team affiliation, workspaces, responsibility ═════════
+
+# ─── Team affiliation (§1.2) ──────────────────────────────────────────
+
+aporg:TeamAffiliation a owl:Class ;
+    rdfs:subClassOf apsit:Situation ;
+    rdfs:comment """Private-by-default Situation: exactly one teamAgent + one affiliatedOrganization +
+      one affiliationKind under signed AffiliationDecision evidence. Informational — never authority.
+      Cross-org teams hold several 'chartered' affiliations (joint charter) or one from an Alliance.""" .
+
+aporg:teamAgent a owl:ObjectProperty ;
+    rdfs:domain aporg:TeamAffiliation ; rdfs:range ap:TeamAgent .
+aporg:affiliatedOrganization a owl:ObjectProperty ;
+    rdfs:domain aporg:TeamAffiliation ; rdfs:range ap:OrganizationAgent .
+aporg:affiliationKind a owl:ObjectProperty ;
+    rdfs:domain aporg:TeamAffiliation ; rdfs:range skos:Concept ;
+    rdfs:comment "aporg:affiliationKindScheme — chartered | engaged (cbox)." .
+aporg:mandatedByDelegation a owl:ObjectProperty ;
+    rdfs:domain aporg:TeamAffiliation ; rdfs:range apdel:Delegation ;
+    rdfs:comment """The chartering org's mandate — the delegation org→team that MATERIALIZES what the
+      affiliation only evidences. The gate verifies the delegation, never this record.""" .
+
+aporg:AffiliationProposal a owl:Class ; rdfs:subClassOf prov:Entity .
+aporg:AffiliationDecision a owl:Class ; rdfs:subClassOf prov:Entity ;
+    rdfs:comment """Signed accept/reject. Both stewards for 'engaged' and post-hoc 'chartered'; the
+      chartering steward alone when minted by the team-create ceremony itself.""" .
+aporg:AffiliationTermination a owl:Class ; rdfs:subClassOf prov:Entity ;
+    rdfs:comment "Either side, unilaterally. Ends currency; revokes nothing." .
+
+aporg:charteredBy a owl:ObjectProperty ;
+    rdfs:domain ap:TeamAgent ; rdfs:range ap:OrganizationAgent ;
+    rdfs:comment "DERIVED: current 'chartered' TeamAffiliation exists. Never asserted globally." .
+aporg:engagedWith a owl:ObjectProperty ;
+    rdfs:domain ap:TeamAgent ; rdfs:range ap:OrganizationAgent ;
+    rdfs:comment "DERIVED: current 'engaged' TeamAffiliation exists." .
+
+# ─── Boundary cases (§1.1, §1.4) ──────────────────────────────────────
+
+aporg:WorkingGroup a owl:Class ; rdfs:subClassOf prov:Entity ;
+    rdfs:comment """An informal named collection of agents — NOT an agent: no custody, no authority.
+      Promotable by chartering a TeamAgent (a creation ceremony, never a mutation).""" .
+
+aporg:InterorganizationalCollaborationArrangement a owl:Class ; rdfs:subClassOf prov:Entity ;
+    rdfs:comment """A loose partnership among organizations. Becomes ap:AllianceAgent only when real
+      joint authority is delegated.""" .
+
+# ─── Workspace: the coordination plane (§2) ───────────────────────────
+
+aporg:Workspace a owl:Class ; rdfs:subClassOf prov:Entity ;
+    rdfs:comment """A persistent, governed, purpose-bound coordination plane binding participant
+      agents, roles, responsibilities, policies, app/agent/resource bindings and representations.
+      NOT an agent, NOT a tenant: no custody, no address, no authority of its own. Governance
+      inherited from its governor; records in the governor's vault (ADR-0055). Several apps may
+      bind to ONE workspace — none of them recreates the org, team, roles, or domain context.""" .
+
+aporg:governedBy a owl:ObjectProperty ;
+    rdfs:domain aporg:Workspace ; rdfs:range ap:OrganizationAgent ;
+    rdfs:comment """Exactly one governing agent (org, team, or alliance). Source of every policy the
+      workspace has. Switching workspace = switching authority/policy/disclosure/audit context.""" .
+aporg:workspacePurpose a owl:DatatypeProperty ;
+    rdfs:domain aporg:Workspace ; rdfs:range xsd:string .
+aporg:workspaceProfile a owl:ObjectProperty ;
+    rdfs:domain aporg:Workspace ; rdfs:range skos:Concept ;
+    rdfs:comment """aporg:workspaceProfileScheme. One primary profile; apps declare which profiles
+      they support and the catalog matches on it.""" .
+aporg:focusedOn a owl:ObjectProperty ;
+    rdfs:domain aporg:Workspace ;
+    rdfs:comment """What the collaboration is ABOUT (a field, an initiative — domain profiles narrow
+      the range). The focus is not the workspace (review §12: a community or engagement within a
+      workspace is not another workspace).""" .
+aporg:workspaceParticipationPolicy a owl:ObjectProperty ;
+    rdfs:domain aporg:Workspace ; rdfs:range skos:Concept ;
+    rdfs:comment """open (derived from the governor's membership — never asserted) | restricted
+      (asserted WorkspaceParticipation records).""" .
+
+# Agents layer (§2.1)
+aporg:WorkspaceParticipation a owl:Class ; rdfs:subClassOf apsit:Situation ;
+    rdfs:comment """Asserted participation in a RESTRICTED workspace: exactly one participantAgent
+      (ANY agent kind) + one inWorkspace, by invitation → accept. An org/team participant projects
+      its people in through its own live roster — never copied (the 341 §5.1c resolution pattern;
+      Gather27's GatherHost is this record).""" .
+aporg:participantAgent a owl:ObjectProperty ;
+    rdfs:domain aporg:WorkspaceParticipation ; rdfs:range ap:Agent .
+aporg:inWorkspace a owl:ObjectProperty ;
+    rdfs:domain aporg:WorkspaceParticipation ; rdfs:range aporg:Workspace .
+
+aporg:coordinatedBy a owl:ObjectProperty ;
+    rdfs:domain aporg:Workspace ; rdfs:range ap:WorkspaceAgent ;
+    rdfs:comment """The ap:WorkspaceAgent: a service-kind SA the GOVERNOR delegates to (the
+      spec-327 assistant pattern, workspace-scoped). Provides the workspace's A2A/MCP surface —
+      projection publishing, notifications, audit. NEVER an independent source of authority:
+      revoke the governor's delegation and it is inert. Range narrowed from ap:ServiceAgent to
+      ap:WorkspaceAgent by spec 346 §2.2 — the workspace agent is the derived type the
+      '.workspace' suffix names.""" .
+
+aporg:coordinatesWorkspace a owl:ObjectProperty ;
+    rdfs:domain ap:WorkspaceAgent ; rdfs:range aporg:Workspace ;
+    owl:inverseOf aporg:coordinatedBy ;
+    rdfs:comment """The workspace context this workspace agent custodies and serves. At most one. The
+      NAME binds to the workspace agent SA (the workspace's agentive face); the context is a governed
+      Entity in the governor's vault (spec 344 §5) and is never itself named.""" .
+
+aporg:boundAgent a owl:ObjectProperty ;
+    rdfs:domain aporg:Workspace ; rdfs:range ap:Agent ;
+    rdfs:comment """A specialized domain agent bound into the workspace. The binding must reference
+      which principal it represents (mandate), which responsibility it supports (assignment), and
+      which data it may access (grants) — three references, never new authority.""" .
+
+# Entities layer (§2.2)
+aporg:WorkspaceRepresentation a owl:Class ; rdfs:subClassOf prov:Entity ;
+    rdfs:comment """A workspace-scoped, policy-bounded PROJECTION of a domain entity whose
+      authoritative record stays in its custodian's vault. Conventional SaaS: record belongs to
+      tenant. Here: entity exists independently; custodian controls the record; the workspace
+      receives an authorized representation that can expire or be revoked without the record ever
+      moving. Crosswalk: at:DataProjection under an at:DataCovenant; decision record precedent:
+      eng:ProjectionManifest (field-domain). NORMATIVE FLOOR: absence of a policy is never public —
+      an unclassified representation fails closed.""" .
+
+aporg:represents a owl:ObjectProperty ;
+    rdfs:domain aporg:WorkspaceRepresentation ;
+    rdfs:comment "The domain entity represented. Range open — domain profiles narrow it." .
+aporg:representationOfWorkspace a owl:ObjectProperty ;
+    rdfs:domain aporg:WorkspaceRepresentation ; rdfs:range aporg:Workspace .
+aporg:sourceCustodian a owl:ObjectProperty ;
+    rdfs:domain aporg:WorkspaceRepresentation ; rdfs:range ap:Agent ;
+    rdfs:comment "Whose vault holds the authoritative record. Custody NEVER moves." .
+aporg:localLabel a owl:DatatypeProperty ;
+    rdfs:domain aporg:WorkspaceRepresentation ; rdfs:range xsd:string ;
+    rdfs:comment "How THIS workspace knows the entity — the org-local-name pattern generalized." .
+aporg:sharingPolicy a owl:ObjectProperty ;
+    rdfs:domain aporg:WorkspaceRepresentation ; rdfs:range skos:Concept ;
+    rdfs:comment """Disclosure bound on the representation (sensitivity / precision caps — domain
+      packs supply the scheme, e.g. eng: sensitivity L0–L5 + gc: location precision).""" .
+aporg:representationValidUntil a owl:DatatypeProperty ;
+    rdfs:domain aporg:WorkspaceRepresentation ; rdfs:range xsd:dateTime .
+
+aporg:adoptedResource a owl:ObjectProperty ;
+    rdfs:domain aporg:Workspace ;
+    rdfs:comment """A versioned external resource the workspace adopts for its purpose (the resource
+      fabric: provider publishes → HOME discovers/licenses → WORKSPACE adopts a version → APP
+      renders). A representation whose source is a provider, not a participant vault.""" .
+
+# App bindings (§2.4)
+aporg:boundApp a owl:ObjectProperty ;
+    rdfs:domain aporg:Workspace ;
+    rdfs:comment """An application (OIDC client) bound into this workspace. PROJECTION ONLY — the
+      app's reads still ride its own per-app read grants (spec 341 §4.3); binding grants nothing,
+      unbinding revokes nothing but presence. Several apps per workspace is the point (§2.4).""" .
+
+apmsg:hostedInWorkspace a owl:ObjectProperty ;
+    rdfs:domain apmsg:DiscussionTopic ; rdfs:range aporg:Workspace ;
+    rdfs:comment """A topic MAY be hosted in one workspace of the same governor. Absent = the
+      org-wide board (today's behavior, unchanged).""" .
+
+# ─── Responsibility (§1.5) ────────────────────────────────────────────
+
+aporg:ResponsibilityAssignment a owl:Class ; rdfs:subClassOf apsit:Situation ;
+    rdfs:comment """A time-scoped, visible commitment: an agent is expected to care for an outcome or
+      resource within a scope, under named authority and accountability. NEVER an authorization.
+      More durable than an app task: one responsibility → many work items → many apps; survives
+      app replacement. Five questions, five concepts (spec 344 §1.5).""" .
+
+aporg:responsibleAgent a owl:ObjectProperty ;
+    rdfs:domain aporg:ResponsibilityAssignment ; rdfs:range ap:Agent .
+aporg:accountableAgent a owl:ObjectProperty ;
+    rdfs:domain aporg:ResponsibilityAssignment ; rdfs:range ap:Agent ;
+    rdfs:comment "Who answers for the result. MAY differ from responsibleAgent." .
+aporg:responsibilityKind a owl:ObjectProperty ;
+    rdfs:domain aporg:ResponsibilityAssignment ; rdfs:range skos:Concept .
+aporg:responsibilityScope a owl:ObjectProperty ;
+    rdfs:domain aporg:ResponsibilityAssignment ;
+    rdfs:comment "A workspace, team, engagement, record family — domain profiles narrow the range." .
+aporg:underMandate a owl:ObjectProperty ;
+    rdfs:domain aporg:ResponsibilityAssignment ; rdfs:range apdel:Delegation ;
+    rdfs:comment "The authority the responsible agent exercises — a reference, not a grant." .
+aporg:expectedOutcome a owl:DatatypeProperty ;
+    rdfs:domain aporg:ResponsibilityAssignment ; rdfs:range xsd:string .
+aporg:reviewCadenceDays a owl:DatatypeProperty ;
+    rdfs:domain aporg:ResponsibilityAssignment ; rdfs:range xsd:integer .

package/tbox/payload.ttl

@@ -0,0 +1,94 @@
+# T-box — WHAT A WRITE CARRIES (spec 410 §7, THESIS-6/THESIS-7's information-flow half).
+#
+# An aggregate limit at the resource says how MUCH may leave (`TreasurySpendPolicy`); this says WHAT KIND of
+# information an act may carry out of the estate. A tool's adapter declares, per argument, the classes its payload
+# carries (`ToolSpec.carries`, `SkillExecutionContractV1.carries`); a mandate's payload-classes caveat
+# (`PayloadClassesEnforcer`) names what the write MAY carry; the verifier compares the two. An argument whose class
+# the caveat does not name is refused — an undeclared payload is not within it.
+#
+# THESE ARE CLASSES OF INFORMATION, NOT OF VALUES. `apval:EmailAddress` says how an argument is READ ("is this
+# well-formed?"); `appay:ContactEmail` says what it DISCLOSES when it leaves ("someone's address is now in the
+# message"). One value can carry several: a free-text body may carry an email address the person typed. The
+# declaration is the ADAPTER AUTHOR's claim about the argument's kind, never an inspection of its content — a
+# classifier reading bodies for phone numbers is exactly the heuristic this vocabulary exists to replace.
+#
+# The one class every free-text argument carries is appay:FreeText: the person's own words, which may carry
+# anything. A mandate that permits FreeText permits what the person chose to write; a mandate that does not
+# refuses a body the planner composed. That is the honest floor, and it is why "text" arguments are declared
+# rather than left undeclared (undeclared = denied under any caveat).
+
+@prefix appay: <https://agenticprimitives.dev/ns/payload#> .
+@prefix apval: <https://agenticprimitives.dev/ns/value#> .
+@prefix ap:    <https://agenticprimitives.dev/ns/core#> .
+@prefix rdfs:  <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix owl:   <http://www.w3.org/2002/07/owl#> .
+@prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .
+@prefix skos:  <http://www.w3.org/2004/02/skos/core#> .
+
+appay: a owl:Ontology ;
+    rdfs:label "Agentic Primitives — Payload classes (what a write carries)" ;
+    rdfs:comment "The kinds of information an act may carry out of the estate: declared per argument by a tool's adapter, permitted by a mandate's payload-classes caveat, compared by the verifier (spec 410 §7). Classes of DISCLOSURE, not of value syntax (apval:)." .
+
+appay:PayloadClass a owl:Class ;
+    rdfs:label "PayloadClass" ;
+    rdfs:comment "A kind of information a write may carry. Every payload class is a subclass; a caveat names subclasses, never this root (naming the root would permit everything, which is the absence of a caveat said twice)." .
+
+appay:FreeText a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "FreeText" ;
+    rdfs:comment "The person's own words, or a body composed on their behalf: may carry anything. The floor every text argument declares. A mandate that does not permit it refuses composed bodies." .
+
+appay:ContactEmail a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "ContactEmail" ;
+    rdfs:comment "Someone's email address leaves with the write (an invitation carrying it; a message body that names one)." .
+
+appay:ContactPhone a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "ContactPhone" ;
+    rdfs:comment "Someone's phone number leaves with the write." .
+
+appay:PostalAddress a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "PostalAddress" ;
+    rdfs:comment "Where someone lives or receives mail leaves with the write." .
+
+appay:EventDetails a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "EventDetails" ;
+    rdfs:comment "When and where a gathering happens, and its title — what an invitation or a calendar entry carries." .
+
+appay:GivingHistory a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "GivingHistory" ;
+    rdfs:comment "What someone has given, to whom, when — a treasury's or a person's giving records." .
+
+appay:Money a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "Money" ;
+    rdfs:comment "Value moves with the write: an amount of an asset. The AMOUNT is bounded by the spend policy and the value caveat; this class says only that the write is a transfer, so a payload caveat that omits it refuses a payment outright." .
+
+appay:File a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "File" ;
+    rdfs:comment "A document or attachment leaves with the write, whatever it contains — the file's own classes are not inspected." .
+
+appay:MembershipTerms a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "MembershipTerms" ;
+    rdfs:comment "The terms of a membership or a household relation (a role, a kinship word) leave with the write." .
+
+appay:PersonalPreference a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "PersonalPreference" ;
+    rdfs:comment "Something the person wants remembered about how they are answered, what they call things, when their routines run — written into their own agent's records." .
+
+appay:Instruction a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "Instruction" ;
+    rdfs:comment "A standing instruction or a routine's rule: words that will shape future acts, written into the agent's own records." .
+
+appay:CodeChange a owl:Class ;
+    rdfs:subClassOf appay:PayloadClass ;
+    rdfs:label "CodeChange" ;
+    rdfs:comment "Source files or a pull request leave with the write — a build artifact, a PR body." .